MS ends the support of TLS prior to 1.2 in october. https://support.microsoft.com/en-us/help/4057306/preparing-for-tls-1-2-in-office-365 Is TLS 1.2 supported on Discourse?

[图片] Pierre_GRAND: Is TLS 1.2 supported on Discourse? Yes: https://github.com/discourse/discourse_docker/blob/master@{2018-02-13}/templates/web.ssl.template.yml#L21

@sam @mpalmer should we even be supporting TLS v1? That seems positively ancient .. as of 2014 all major browsers supported TLS v1.2?

I’m happy to nuke older browser support if you want. It’d reduce the cipher list, too, because most of the entries in there are to support older browsers. The main reason I didn’t go “full strict” last time I reviewed those settings is because while you can gracefully degrade UI on older browsers, to (at the very least) tell people “your browser is from the 90s, man!”, you can’t gracefully degrade TLS connections – if a protocol negotiation doesn’t happen successfully, it’s ugly (browser-provided) error page time, no exceptions, no chance for the site to give any useful information.

It looks like we are safe to disable TLS V1 at least because we don’t support IE10, and IE11 supports TLS V1.1 [augurar] Should I disable TLS 1.0 on my servers? tls, webserver, pci-dss, known-vulnerabilities asked by augurar on 07:41PM - 23 Nov 15 UTC

Oh but Matt’s point of you don’t even get an error page or anything except for “broken cert” kind of stands. I think that given: TLS 1, when properly configured has no known security vulnerabilities. Newer protocols are better designed and better address the potential for new vulnerabilities. I think we should just leave it for now. I strongly agree we should remove any ciphers that are compromised.

It is pointless though any browser so old that it only supports TLS v1 will not load Discourse’s advanced JS anyways.

Sure, but I wonder, does this mean we want to remove? https://github.com/discourse/discourse/blob/master/vendor/assets/javascripts/browser-update.js.erb

Maybe, looking at the old dates there and market share of ancient stuff..

Just as a reference of what others are doing, GitHub (which admittedly has an audience that is rather likely to keep browsers up to date) is disabling TLS 1.0 and 1.1 now: [图片] Weak cryptographic standards removal notice Last year we announced the deprecation of several weak cryptographic standards. Then we provided a status update toward the end of last year outlining some changes we’d made to make… Est. reading time: 1 minute

We should remove tls v1 @mpalmer — that seems quite safe to me.

自2018年10月31日起，Microsoft Office 365将不再支持TLS 1.0和1.1

产品支持

Falco (Falco) 2020 年3 月 22 日 16:10 21

And TLS 1.3 since

话题		回复	浏览量
SSL/TLS errors on very old browsers connecting to Discourse Product Support	17	4745	2019 年9 月 9 日
'Could not create SSL/TLS secure channel error' when connecting to Discourse API from Windows Server Product Support	6	1377	2019 年9 月 15 日
Enabling TLS 1.3 Feature	6	2253	2023 年3 月 27 日
Discourse not working on an old phone with an unsupported browser Product Support	14	2476	2020 年2 月 7 日
What versions of Windows are supported? Product Support	20	916	2026 年4 月 30 日

自2018年10月31日起，Microsoft Office 365将不再支持TLS 1.0和1.1

相关话题